ThreatCluster

Multiple Vulnerabilities in Microsoft Dynamics 365 Field Service Identified

First seen 12 Nov 2025, 21:25 UTC • •37

Article Content

1 / 4

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

Two spoofing vulnerabilities (CVE-2025-62211 and CVE-2025-62210) have been identified in Dynamics 365 Field Service (online), allowing authorized attackers to perform spoofing via improper input neutralization during web page generation. Additionally, CVE-2025-62206 exposes sensitive information in Dynamics 365 (on-premises) to unauthorized actors over a network.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 217d ago How this analysis works

More articles in this cluster (3)

Threat Graph

6 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Data Breach
Cross-site Scripting

Vulnerability (4)

CVE-2025-62206
CVE-2025-62210
CVE-2025-62211
XSS

Relationships

CVE-2025-62206 related to Data Breach
CVE-2025-62206 related to Cross-site Scripting
CVE-2025-62206 related to CVE-2025-62210
CVE-2025-62206 related to CVE-2025-62211
CVE-2025-62206 related to XSS

Following this threat?

Track CVE-2025-62206 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical XSS Vulnerability in SUSE Rancher Exposes Admin Sessions A critical vulnerability (CVE-2026-88804) in SUSE Rancher allows unauthenticated remote attackers to execute stored cross-site scripting (XSS) attacks via public UI settings. This affects Rancher versions 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14, and 2.11 before 2.11.18.…

Multiple WordPress Plugins Face Vulnerabilities Requiring Immediate Updates Three WordPress plugins have been reported with vulnerabilities: the GiveWP plugin (version 4.16.9) has a Cross Site Scripting (XSS) vulnerability, while both the Siteskite (version 2.1.8) and Cartflows (version 3.2.0) plugins have Remote Code Execution (RCE) vulnerabilities. The XSS vulnerability allows attackers to…